A software defined network (SDN) is a relatively new type of networking architecture that provides centralized control of network elements rather than a distributed architecture utilized by conventional networks. That is, in a distributed architecture each network element makes a routing decision based on the results of traffic processing and a distributed control mechanism. In contrast, in the SDN, a network element follows routing decisions received from a central controller. In detail, the operation of a network element can be logically divided into a “control path” and a “data path”. In the control path, control protocols, e.g., for building in routing protocols, a spanning tree, and so on, are operable. In the data path, packets-processing operations are performed. Such operations include examining each input packet and making decisions based on the examination as to how to handle the input packet (e.g., packet forwarding, packet switching, bridging, load balancing, and so on). Furthermore, in a conventional network, network elements typically include both a control plane and a data plane, whereas in a SDN, the network elements include the data path, and the central controller implements the control path.
The SDN can be implemented in wide area networks (WANs), local area networks (LANs), the Internet, metropolitan area networks (MANs), ISP backbones, datacenters, and the like. Each network element in the SDN may be a router, a switch, a bridge, a load balancer, and so on, as well as any virtual instantiations thereof.
In one configuration of a SDN, the central controller communicates with the network elements using an OpenFlow protocol which provides a network abstraction layer for such communication. Specifically, the OpenFlow protocol allows adding programmability to network elements for the purpose of packets-processing operations under the control of the central controller, thereby allowing the central controller to define the traffic handling decisions in the network element.
Traffic received by a network element that supports the OpenFlow is processed and routed according to a set of rules defined by the central controller based on the characteristic of the required network operation. Such a network element routes traffic according to a flow table and occasionally sends packets to the central controller. Each network element is preconfigured with a flow table and can be modified by the central controller as required. The operation of network elements according to the OpenFlow protocol is further described in the “OpenFlow Switch Specification”, Version 1.1.3, published on Apr. 16, 2012 by Open Networking Foundation, the contents of which are hereby incorporated by reference merely for the useful understanding of the background.
Thus, the OpenFlow protocol and SDN allow utilizing the hardware speed processing capability of conventional network elements while providing more flexibility in the traffic packet-processing decisions. As noted above, packets-processing operations include, but are not limited to, routing, load balancing, forwarding, switching, and bridging of packets. While the OpenFlow protocol allows the programmability of network elements in the SDN, this protocol does not define how this capability can be utilized to efficiently provide value added services including, but not limited to, security services to users of the SDN.
A significant problem facing the Internet community is that on-line businesses and organizations are vulnerable to malicious attacks. Recently, attacks have been committed using a wide arsenal of attack techniques and tools targeting both the information maintained by the on-line businesses and their IT infrastructure. Hackers and attackers are constantly trying to improve their attacks to cause irrecoverable damage, overcome currently deployed protection mechanisms, and so on.
Attacks and attack attempts are executed against servers and clients at different layers (e.g., a network layer and an application layer). Attacks have become more sophisticated and their scope has also been increased. That is, a multitude number of infected machines and groups of organized attackers take part in coordinated attack campaigns. Thus, it has become a significant challenge to secure online businesses and organizations against targeted attack campaigns.
As a result, organizations and businesses lose revenue due to security-related downtime, information theft, and the compromise of confidential information. Consequently, the organizations and businesses suffer immeasurable damage to their brand and image. In many cases, even after the attack has stopped, the remediation process can be a long and expensive process. That is, it may take a long time to restore the services/applications provided by the attacked site back to functioning properly.
Currently available security systems cannot guarantee full protection against a vast number of cyber threat categories and the numerous number of attack vectors that exist to execute such threats. As a result, when a site or a data center is under attack, a portion of the site or the entire site may be idle, and legitimate clients cannot access the servers of the site, or they experience a very low service response (high latency). Examples for cyber-attacks include denial-of-service (DoS), intrusion type of attacks, buffer overflow attacks, misuse of computing resources, and the like. Types of (web directed) attacks include, for example, web defacement attacks, cross site scripting attacks, and more.
Although there are various security systems designed to detect, mitigate, and prevent cyber-attacks, there is no security system that can fully guarantee that such attacks will not succeed in negatively impacting the sites' services, and that clients of the site will not be affected. Thus, when a site is under attack, there is always a chance that the Quality of Service (QoS) is compromised and the service-level agreement (SLA) cannot be guaranteed to the site's users.
It would therefore be advantageous to provide an efficient solution that would ensure continuous services and guarantee the SLA for legitimate and trusted clients even when the site is under attack.